Is CVE-2026-40564 actively exploited?

No active exploitation of CVE-2026-40564 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40564 be exploited remotely?

Yes. CVE-2026-40564 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40564?

CVE-2026-40564 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40564

MEDIUM

CVE-2026-40564

CWE-552Published: May 26, 2026· Updated: Jun 1, 2026

6.5

CVSS v3.1

Official Description

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.

The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.

Users are recommended to upgrade to version 1.15.0, which fixes the issue.

NVD Source

Technical Analysis

CVE-2026-40564 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.